Alternate PowerShell Hosts Pipe

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

PipeName|startswith: '\PSHost'

or:
Image|contains: 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
Image|contains: '\pwsh.exe'
Image|contains: '\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview'
Image|contains: '\pwsh.exe'
Image: null
Image|contains: ':\Program Files\PowerShell\7-preview\pwsh.exe'
Image|contains: ':\Program Files\PowerShell\7\pwsh.exe'
Image|contains: ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
Image|contains: ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
Image|contains: ':\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
Image|contains: ':\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
Image|contains: ':\Windows\System32\sdiagnhost.exe'
Image|contains: ':\Windows\System32\wsmprovhost.exe'
Image|contains: ':\Windows\system32\ServerManager.exe'
Image|contains: ':\Windows\system32\dsac.exe'
Image|contains: ':\Windows\system32\inetsrv\w3wp.exe'
Image|contains: ':\Windows\system32\wbem\wmiprvse.exe'

or:
or:
Image|startswith: 'C:\Program Files (x86)\'
Image|startswith: 'C:\Program Files\'
Image|endswith: '\Tools\Binn\SQLPS.exe'
Image|contains: '\Microsoft SQL Server\'
Image|endswith: '\GC\gc_worker.exe'
Image|startswith: 'C:\Program Files\AzureConnectedMachineAgent\GCArcService'
Image|startswith: 'C:\Program Files\Citrix\'
Image|startswith: 'C:\Program Files\Microsoft\Exchange Server\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.